Read the native library out of the app bundle, not a stale APK

`react-native build-android` runs bundleDebug and writes
outputs/bundle/debug/app-debug.aab. There is no outputs/apk/debug directory at
all, so the alignment step's `find` failed before it reached any ELF, on both
the original version and the rewrite. It passed locally only because an APK
from an earlier `run-android` was still lying in the build directory — the
check was reading an artifact that CI never produces.

The step now takes whichever artifact exists, and the checker accepts a
directory and fails when it contains no .so files, so "nothing was checked"
can no longer read as "everything checked out". Verified against the real
bundle, a multi-ABI APK, an empty directory, a library patched to 0x1000, and
no arguments.

Author: Muhammad Ahmad

.github/workflows/ci.yml

@@ -114,16 +114,21 @@ jobs:
         run: pnpm build:android
 
       # Google Play requires 16 KB page-size support for apps targeting Android
-      # 15+. Our own native library is the one we can guarantee, so assert it
-      # rather than trusting whichever NDK the runner happens to have.
+      # 15+. `react-native build-android` produces an app bundle, so the library
+      # is read out of the .aab — an .apk is accepted too, for when that command
+      # changes or someone runs this against a locally assembled build.
       - name: Native library is 16 KB aligned
         run: |
           set -euo pipefail
-          APK=$(find example/android/app/build/outputs/apk/debug -name '*.apk' -print -quit)
-          echo "APK: $APK"
-          rm -rf "${RUNNER_TEMP}/apkcheck"
-          unzip -o -q "$APK" 'lib/*/librnsecuritytoolkit.so' -d "${RUNNER_TEMP}/apkcheck"
-          node scripts/check-elf-alignment.mjs "${RUNNER_TEMP}"/apkcheck/lib/*/librnsecuritytoolkit.so
+          ARTIFACT=$(find example/android/app/build/outputs \( -name '*.aab' -o -name '*.apk' \) -print -quit)
+          if [ -z "$ARTIFACT" ]; then
+            echo "no .aab or .apk under example/android/app/build/outputs"
+            exit 1
+          fi
+          echo "artifact: $ARTIFACT"
+          rm -rf "${RUNNER_TEMP}/nativecheck"
+          unzip -o -q "$ARTIFACT" '*librnsecuritytoolkit.so' -d "${RUNNER_TEMP}/nativecheck"
+          node scripts/check-elf-alignment.mjs "${RUNNER_TEMP}/nativecheck"
 
   build-ios:
     name: Build iOS

scripts/check-elf-alignment.mjs

@@ -14,10 +14,15 @@
  * 32-bit ABIs are reported but not enforced: the 16 KB page size applies to
  * 64-bit devices.
  *
- * Usage: node scripts/check-elf-alignment.mjs <file.so> [...]
+ * A directory argument is walked for `.so` files, and finding none is a
+ * failure rather than a silent pass — "nothing was checked" and "everything
+ * checked out" must not look alike in a CI log.
+ *
+ * Usage: node scripts/check-elf-alignment.mjs <file.so | directory> [...]
  */
 
 import fs from 'node:fs/promises';
+import path from 'node:path';
 import process from 'node:process';
 
 const REQUIRED_ALIGNMENT = 16 * 1024;
@@ -56,14 +61,43 @@ function loadSegmentAlignments(buffer) {
   return { is64Bit, alignments };
 }
 
+/** Expands directory arguments into the `.so` files they contain. */
+async function collectLibraries(targets) {
+  const files = [];
+
+  for (const target of targets) {
+    const stats = await fs.stat(target);
+    if (!stats.isDirectory()) {
+      files.push(target);
+      continue;
+    }
+    for (const entry of await fs.readdir(target, { recursive: true, withFileTypes: true })) {
+      if (entry.isFile() && entry.name.endsWith('.so')) {
+        files.push(path.join(entry.parentPath ?? entry.path, entry.name));
+      }
+    }
+  }
+
+  return files.sort();
+}
+
 async function main() {
-  const files = process.argv.slice(2);
-  if (files.length === 0) {
-    process.stderr.write('usage: node scripts/check-elf-alignment.mjs <file.so> [...]\n');
+  const targets = process.argv.slice(2);
+  if (targets.length === 0) {
+    process.stderr.write(
+      'usage: node scripts/check-elf-alignment.mjs <file.so | directory> [...]\n'
+    );
     process.exitCode = 2;
     return;
   }
 
+  const files = await collectLibraries(targets);
+  if (files.length === 0) {
+    process.stdout.write(`  FAIL  no .so files found in: ${targets.join(', ')}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
   let failures = 0;
 
   for (const file of files) {